MCP, MCP server
Bruno Mcp
A Model Context Protocol (MCP) server for generating Bruno API testing files programmatically.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 9b625b8b0c09, unchanged since the check below.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 17
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
src/bruno/environment.ts, line 120
await fs.unlink(envFilePath);
Install and update
Concern
runs a script at install time. dependencies are not pinned. The docs document an installer that pipes a download into a shell.
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED INSTALL_DOCUMENTED_INSTALLER
package.json, line 17
prepare
package.json, line 30
@modelcontextprotocol/sdk
docs/mcp.md, line 6823
curl -LsSf https://astral.sh/uv/install.sh | sh
Network
Concern
can reach api.weather.com. The description does not name that host. can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
docs/MCP Typescript readme.md, line 219
const response = await fetch(`https://api.weather.com/${city}`);
docs/mcp.md, line 3863
fetch("/mcp", {
docs/mcp.md, line 4231
const response = await fetch(serverUrl, {
Show more
docs/mcp.md, line 4251
const sseResponse = await fetch(serverUrl, {
docs/mcp.md, line 7252
const response = await fetch(url, { headers });
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
src/bruno/collection.ts, line 35
ignore: input.ignore || ['node_modules', '.git', '.env']
src/bruno/collection.ts, line 258
.env
src/bruno/collection.ts, line 259
.env.local
Show more
src/bruno/collection.ts, line 260
.env.*.local
.gitignore, line 14
# Environment files
.gitignore, line 15
.env
.gitignore, line 16
.env.local
docs/mcp.md, line 4359
* Always use absolute paths in your configuration and `.env` files to ensure reliable operation
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
docs/mcp.md, line 1
# Example Clients
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Note
the latest commit is more than 365 days old.
MAINTAINER_STALE
No file path was stored.
2025-07-19T12:23:02+07:00
Note
Hygiene check of commit 9b625b8b0c09. can delete files. runs a script at install time. dependencies are not pinned. The docs document an installer that pipes a download into a shell. can reach api.weather.com. The description does not name that host. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the latest commit is more than 365 days old.
Date and source
Date checked:
github.com
Commit graded: 9b625b8b0c09b84a44c2ae116f87c140fb5b5d1b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.